D7net
Home
Console
Upload
information
Create File
Create Folder
About
Tools
:
/
usr
/
lib
/
python3.6
/
site-packages
/
cloudinit
/
config
/
__pycache__
/
Filename :
cc_ca_certs.cpython-36.pyc
back
Copy
3 �7si�$ � @ s� U d Z ddlZddlZddlmZ ddlmZmZ ddlm Z ddl m Z ddl m Z mZ ddlmZ eje�Zdd d d d gd �Zdddddgd �dddddgd �ddddd gd �d�Zxd:D ]Zed ee< q�W xd;D ]Zed ee< q�W d Zd d d d!d"d dddddddd#gZd$d%d&eeeed'�gd(d)gd*�Ze ee�Z d+d,� Zd-d.� Zd/d0� Z d1d2� Z d3d4� Z d5d6� Z e e e e!dd7�d8d9�Z"dS )<z CA Certs: Add ca certificates.� N)�dedent)�subp�util)�Cloud)�Config)� MetaSchema� get_meta_doc)� PER_INSTANCEz!/usr/local/share/ca-certificates/z#cloud-init-ca-cert-{cert_index}.crtz/etc/ca-certificates.confzupdate-ca-certificates)� ca_cert_path�ca_cert_local_path�ca_cert_filename�ca_cert_config�ca_cert_update_cmdz/etc/pki/ca-trust/z /usr/share/pki/ca-trust-source/z+anchors/cloud-init-ca-cert-{cert_index}.crtzupdate-ca-trustz/etc/pki/trust/z/usr/share/pki/trust/)�fedora�rhel�opensuse�opensuse-microos�opensuse-tumbleweed� opensuse-leap�sle_hpc� sle-micro�slesr � almalinux� cloudlinuxr a/ This module adds CA certificates to the system's CA store and updates any related files using the appropriate OS-specific utility. The default CA certificates can be disabled/deleted from use by the system with the configuration option ``remove_defaults``. .. note:: certificates must be specified using valid yaml. in order to specify a multiline certificate, the yaml multiline list syntax must be used .. note:: Alpine Linux requires the ca-certificates package to be installed in order to provide the ``update-ca-certificates`` command. �alpine�debianr �ubuntuZ cc_ca_certszCA CertificateszAdd ca certificatesa ca_certs: remove_defaults: true trusted: - single_line_cert - | -----BEGIN CERTIFICATE----- YOUR-ORGS-TRUSTED-CA-CERT-HERE -----END CERTIFICATE----- �ca_certszca-certs)�id�name�title� description�distrosZ frequencyZexamplesZactivate_by_schema_keysc C s* t j| t�}tjj|d |d �|d< |S )z�Return a distro-specific ca_certs config dictionary @param distro_name: String providing the distro class name. @returns: Dict of distro configurations for ca_cert. r r �ca_cert_full_path)�DISTRO_OVERRIDES�get�DEFAULT_CONFIG�os�path�join)� distro_name�cfg� r, �!/usr/lib/python3.6/cc_ca_certs.py�_distro_ca_certs_configs| s r. c C s t j | d dd� dS )z� Updates the CA certificate cache on the current machine. @param distro_cfg: A hash providing _distro_ca_certs_configs function. r F)ZcaptureN)r )� distro_cfgr, r, r- �update_ca_certs� s r0 c C sL |sdS x>t |d�D ]0\}}t|�}| d j|d�}tj||dd� qW dS )a- Adds certificates to the system. To actually apply the new certificates you must also call the appropriate distro-specific utility such as L{update_ca_certs}. @param distro_cfg: A hash providing _distro_ca_certs_configs function. @param certs: A list of certificate strings. N� r# )� cert_indexi� )�mode)� enumerate�str�formatr � write_file)r/ Zcertsr2 �cZcert_file_contentsZcert_file_namer, r, r- � add_ca_certs� s r9 c C s@ | dkrt |� n*| d kr<t|� | d kr<d }tjd|d � d S )a. Disables all default trusted CA certificates. For Alpine, Debian and Ubuntu to actually apply the changes you must also call L{update_ca_certs}. @param distro_name: String providing the distro class name. @param distro_cfg: A hash providing _distro_ca_certs_configs function. r r r r z/ca-certificates ca-certificates/trust_new_crts z select no�debconf-set-selections�-)�dataN)r r r )r r z8ca-certificates ca-certificates/trust_new_crts select no)r: r; )�remove_default_ca_certs�disable_system_ca_certsr )r* r/ Z debconf_selr, r, r- �disable_default_ca_certs� s r? c C s� | d }| s t jj|� r dS d}d}t j|�jr�tj|�}g }xh|j� D ]\}||krhd}|j|� qL|dks||d d kr�|j|� qL|s�|j|� d}|jd | � qLW tj |d j |�d d d � dS )z� For every entry in the CA_CERT_CONFIG file prefix the entry with a "!" in order to disable it. @param distro_cfg: A hash providing _distro_ca_certs_configs function. r Nz;# Modified by cloud-init to deselect certs due to user-dataFT� r �#�!� �wb)Zomode)rA rB ) r' r( �exists�stat�st_sizer Z load_file� splitlines�appendr7 r) )r/ Zca_cert_cfg_fnZheader_commentZ added_headerZorigZ out_lines�liner, r, r- r> � s( r> c C s: | d dkrdS t jd� tj| d � tj| d � dS )z� Removes all default trusted CA certificates from the system. @param distro_cfg: A hash providing _distro_ca_certs_configs function. r Nz Deleting system CA certificatesr )�LOG�debugr Zdelete_dir_contents)r/ r, r, r- r= � s r= )r r+ �cloud�args�returnc C s� d|krt jdddd� nd|kr2tjd| � dS d|krLd|krLtjd � |jd|jd��}t|jj�}d |kr�t jd dd d� |jd |jd d��r�tjd� t |jj|� d|kr�t j |d�}|r�tjdt |�� t ||� tjd� t |� dS )au Call to handle ca_cert sections in cloud-config file. @param name: The module name "ca_cert" from cloud.cfg @param cfg: A nested dict containing the entire cloud config contents. @param cloud: The L{CloudInit} object in use. @param log: Pre-initialized Python logger object to use for logging. @param args: Any module arguments from cloud.cfg zca-certszKey 'ca-certs'z22.1zUse 'ca_certs' instead.)Z deprecatedZdeprecated_versionZ extra_messager z<Skipping module named %s, no 'ca_certs' key in configurationNzMFound both ca-certs (deprecated) and ca_certs config keys. Ignoring ca-certs.zremove-defaultszKey 'remove-defaults'z Use 'remove_defaults' instead.Zremove_defaultsFz'Disabling/removing default certificatesZtrustedzAdding %d certificateszUpdating certificates)r Z deprecaterK rL Zwarningr% r. �distror r? Zget_cfg_option_list�lenr9 r0 )r r+ rM rN Z ca_cert_cfgr/ Z trusted_certsr, r, r- �handle� s> rR )r r r r r r )r r )#�__doc__Zloggingr' �textwrapr Z cloudinitr r Zcloudinit.cloudr Zcloudinit.configr Zcloudinit.config.schemar r Zcloudinit.settingsr Z getLogger�__name__rK r& r$ rP ZMODULE_DESCRIPTIONr" �metar. r0 r9 r? r> r= r5 �listrR r, r, r, r- �<module> s� '